Method for computer-assisted operation of a memory unit and execution of application programs with memory checking for memory errors

ABSTRACT

In a method for computer-assisted operation of a memory unit, encoded data is saved in the memory unit. The data is retrieved and decoded after retrieval. The memory unit is monitored for errors in that a temporal sequence of computer-assisted checking operations is carried out for the memory unit. For first-time encoding of the data, each required application data set is generated or selected, containing check data segments. For each application data set, the check data segment is occupied by count data, which characterizes the checking operation being implemented. After retrieving and decoding the application data sets, an error is determined when the count data characterizes neither the checking operation being implemented nor the most recent completely implemented checking operation. The check data segment of the relevant application data set is occupied by count data, which characterizes the checking operation being implemented, if no error was determined.

CROSS-REFERENCE TO RELATED APPLICATION

This application claims the priority, under 35 U.S.C. § 119, of EuropeanPatent Application EP22169515.8, filed Apr. 22, 2022; the priorapplication is herewith incorporated by reference in its entirety.

FIELD AND BACKGROUND OF THE INVENTION

The invention relates to a method for the computer-assisted operation ofa memory unit, wherein data is saved in the memory unit and the data isencoded before saving, data is retrieved from the memory unit and thedata is decoded after retrieval. The memory unit is monitored for errorsin that a temporal sequence of computer-assisted checking operations isimplemented for the memory unit. In addition, the invention relates to amethod for the computer-assisted execution of an application program,wherein a memory unit is operated in the manner described above andwherein application data sets required for the execution are retrievedfrom the memory unit and decoded. Finally, the invention relates to acomputer program product and to a provision apparatus for the computerprogram product. The computer program product is furnished with programcommands for carrying out this method.

In principle, safety-relevant systems, which run in a safety-relevantcomputing environment in a computer-assisted manner, have to guaranteethat no errors occur when retrieving data from a memory unit. Corruptdata may not be used for data processing. Within the framework of thisinvention, safety-relevant is taken to mean the relevance for theoperational safety of the system (also called safety). For example,railroad applications are considered to be safety-relevant systemswithin the meaning of the term.

To safeguard safety-relevant computing environments it is known thatreliably only those components which are used for processing therelevant application are installed on a computer in a plurality ofcomputing instances. When the application then runs in parallel in aplurality of computing instances, it is possible to determine by way ofvoting and in a manner known per se whether errors occur in thecalculation. Storage errors, i.e., memory errors, can also be discoveredin this way.

WO 2014/009243 describes a method and a computer, which have a checkingalgorithm for processing applications in the computing environmentformed by the computer. Application programs are installed on thecomputer, which are executed redundantly, so by comparing thecalculation results it is possible for the checking algorithm todiscover errors (as mentioned, also called voting). This method isconnected with significant expenditure on hardware, however, and doesnot permit reliable error detection in the case of particularconstellations, moreover.

SUMMARY OF THE INVENTION

It is accordingly an object of the invention to provide a method whichovercomes the above-mentioned disadvantages of the heretofore-knowndevices and methods of this general type and which provides for a methodfor the computer-assisted operation of a memory unit and a method forcomputer-assisted execution of an application program, wherein such amemory unit is used with which it is possible to improve the reliabilityof checking memory for memory errors. It is a further object ofinvention to disclose a computer program product and a provisionapparatus for this computer program product with which theabove-mentioned method can be carried out.

With the above and other objects in view there is provided, inaccordance with the invention, a method for computer-assisted operationof a memory unit, the method comprising:

-   -   saving data in the memory unit and encoding the data prior to        saving;    -   retrieving the data from the memory unit and decoding the data        after retrieval;    -   monitoring the memory unit for errors by carrying out a temporal        sequence of computer-assisted checking operations for the memory        unit;    -   for a first-time encoding of the data:        -   generating or selecting at least one application data set            containing data segments having application data for an            application program and check data segments;        -   occupying the check data segment of each application data            set with count data that characterizes the checking            operation being implemented; and        -   encoding and saving each application data set;    -   for checking the data in the checking operation being        implemented, after retrieving and decoding the application data        sets respectively:    -   determining an error for an application data set when the count        data characterizes neither the checking operation being        implemented nor a most recent completely implemented checking        operation;    -   when no error was determined, occupying the check data segment        of the relevant application data set with count data, which        characterizes the checking operation being implemented; and    -   encoding and saving the relevant application data set if no        error was determined.

In other words, the objects of the invention are achieved with theclaimed subject matter disclosed in the introduction (method forcomputer-assisted operation of a memory unit) in that, for first-timeencoding of the data,

-   -   at least one application data set, containing data segments        having application data for an application program and check        data segments is generated or selected,    -   for each application data set, the check data segment is also        occupied by count data, which characterizes the checking        operation being implemented, each application data set is        encoded and saved,    -   and that for checking the data in the checking operation being        implemented, after retrieving and decoding the application data        sets respectively    -   an error is determined for an application data set when the        count data characterizes neither the checking operation being        implemented nor the most recent completely implemented checking        operation,    -   the check data segment of the relevant application data set is        occupied by count data, which characterizes the checking        operation being implemented, if no error was determined,    -   the relevant application data set is encoded again and saved if        no error was determined.

Because a check data segment (which was generated in advance if therewas still no check data segment, or was selected if there was already acheck data segment available for the relevant data segment) is assignedto each of the data segments on first-time encoding, count data can bestored in the relevant data set, which data includes information aboutthe checking operation being implemented. The count data and also theother data of the relevant data segment is protected up until decodingagainst access by way of the subsequent encoding of the relevant dataset. In the encoded state the data namely cannot be accidentally (forexample due to a malfunction) or deliberately (for example due to anexternal attack) changed without a change being identified as an erroron decoding of the data. At any rate it is extremely improbable that thechange does not turn out to be an error on decoding of the data set. Inthis respect there is no protection against changes per se but onlyagainst undiscovered changes. What are known as sleeping errors are alsodiscovered by the cyclical checking of the memory content for correctencoding (using the count data). This means errors, which can occurduring storage of the data, for example due to physical changes in thestorage medium. The low probability of not discovering errors makes itinventively possible to adhere to higher safety levels (safety integritylevels, SIL-1 . . . SIL-4).

Preferably all data that the application program requires is protectedin the data set, that is to say, both the data which makes up theprogram per se and the data which represents information to beprocessed.

For example, it is possible that the count data is changed owing tostorage errors, in other words, errors which occur during storage of thedata on a memory unit (for example, what are known as bit flips) orowing to processing errors, in other words, errors which occur duringprocessing of the data set. Such a change is then determined whenrunning through the next checking operation, however, if the count datacharacterizes neither the checking operation being implemented nor themost recent completely implemented checking operation. An error isdetermined in such a case. Even if the cause thereof perhaps cannot beclearly determined and would be potentially harmless for dataprocessing, for reasons of the safety level to be achieved, after thiserror has been determined it is, for example, output and/or measures aretaken, which prevent further processing of the erroneous data.

Only if no error is determined is the count data in the check datasegment occupied by the count data of the checking operation beingimplemented, the data set encoded and stored again. The relevant dataset is hereby simultaneously characterized as checked in the relevantchecking operation (wherein one possibility as to how data sets outsideof a checking operation can also be occupied by the current count datain the check data segment will be explained later).

Count data has to have the property that it forms a series in which theprecursor and the successor respectively of each element of the set ofcount data is known. In principle, all mathematical series can be usedhere. The set of natural numbers can be particularly preferablyselected.

To implement the checking operation an application program is preferablyused, which implements the checking operation. For this purpose, therelevant application program, which can also be referred to as achecking program, accesses the memory unit, decodes, checks and encodesdata set for data set until a checking operation has been completelyimplemented. For the case where an error is determined, the error can beoutput by the checking program. The checking program can also containfunctions, which contain a reaction to a determined error, for examplesuspension of an application program, which uses the erroneous datasegments of the application (also called application data segments) andcould therefore potentially make safety-relevant errors. Differentsources of error can become evident hereby.

The implementation of the checking operation can be controlled, forexample, via the addressing of the individual data sets. If theaddresses of all data sets are known at the start of the checkingoperation, the data sets can be sequentially retrieved until thechecking operation has ended (more on this below).

If a checking operation is erroneously implemented as a whole to theextent that it does not check all data sets of a checking operation,then this becomes apparent at the latest on the next checking operation,at least provided that the unchecked data sets are checked again in thefollowing checking operation. These then namely still have the countdata of the penultimate checking operation, and this becomes apparentduring the following checking operation. An error is identified herebyand output. The count data therefore also enables monitoring of properimplementation of the checking operations themselves. A further sourceof error becomes evident thereby. Data which is categorized as outdated,and therewith potentially erroneous (because it is not regularly checkedin a checking operation), is not safe enough with regard to itsintegrity, for which reason it is classified as an error.

This creates a safety mechanism, which increases operation of the memoryunit and the execution of application programs (these are serviceprograms or utility programs, more on these below) within the meaning ofthe statement of the object. Safety-relevant applications in particular,for example railroad applications, which as a condition of admissionhave to satisfy particular safety levels (also called safety level,SIL-1 . . . SIL-4 or Safety Integrity Level), advantageously benefitfrom this increase. Within the framework of this invention the term“safety” should be taken to mean operational safety. In particular,encoding takes place primarily from operational safety perspectives andnot from transmission security perspectives. Inventively, an encodingmethod is therefore preferably provided, which achieves a high level ofperformance during encoding and decoding (with the effect of shortencoding and decoding times) and does not guarantee a high level ofdifficulty to decrypt encoding without authorization.

In general, with the inventive method for operation of the memory unitand for execution of application programs, by way of checking of thedata segment, containing data for the application programs, and checkingof the data segment, containing further criteria, which facilitatechecking, it is possible to determine which data sets are actually, orat least potentially, corrupt and therefore jeopardize operationalsafety when the application programs are executed, in particular theutility programs. The affected data sets are characterized by output ofan error and are preferably excluded from data processing in the furthercourse of the method.

In other words, the operational safety is, as it were, inventivelycoupled to the data sets themselves. For this purpose, the data sets areinventively provided with suitable check data segments. Thisadvantageously makes it possible for the data sets to be saved on oneand the same memory unit even if processes run in parallel for reasonsof operational safety. In particular, commercially obtainable softwareand hardware components, so-called COTS components (COTS—CommercialOff-The-Shelf) can consequently be used for storing the data sets andfor executing the application programs without the operational safetyrequirements being jeopardized hereby. Components of this kind can beused, for example, also in railroad engineering applications thereforeand replace proprietary systems. Advantageously, COTS components areinexpensive to acquire and can also be replaced more easily if neededand can be integrated in cloud solutions.

In connection with the invention, the terms “computer-assisted” or“computer-implemented” can be taken to mean an implementation of themethod, wherein at least one computer or processor executes at least onemethod step of the method.

In connection with the invention, the term “computing environment” canbe taken to mean an infrastructure, comprising components such ascomputers, memory units, programs and data to be processed with theprograms, which are used for execution of at least one application,which has a task to fulfil. The infrastructure can also comprise, inparticular, a network of said components.

Within a computing environment, the term “computing instance” (orinstance for short) can be taken to mean a functioning unit, which canbe assigned to an application and can execute this application. When theapplication is executed, this functioning unit forms a physical and/orvirtual self-contained system.

The expression “computer” covers all electronic devices having dataprocessing properties. Computers can be, for example, personalcomputers, servers, handheld computers, mobile radio devices and othercommunication devices, which process data in a computer-assisted manner,processors and other electronic devices for data processing, which canalso be joined together, preferably via interfaces, to form a network.

In connection with the invention, the term “processor” can be taken tomean, for example, a converter, a sensor for generating measuringsignals or an electronic circuit. A processor can be, in particular, aCentral Processing Unit, a microprocessor, a microcontroller, or adigital signal processor, possibly in combination with a memory unit forstoring program commands and data. A processor can also be taken to meana virtualized processor or a soft CPU.

In connection with the invention, the term “memory unit” can be taken tomean, for example, a computer-readable memory in the form of aRandom-Access Memory or data memory (hard disk or data carrier).

“Interfaces” can be implemented in terms of hardware, for example wiredor as a radio connection, and/or in terms of software, for example as aninteraction between individual program modules or program parts of oneor more computer program(s).

“Cloud” should be taken to mean an environment for “Cloud Computing”(also referred to as computer cloud or data cloud). What is meant is anIT infrastructure, which is made available via interfaces of a networksuch as the Internet. As a rule it includes memory space, computingpower or software as a service without these having to be installed onthe local computer using the Cloud. The services offered in theframework of Cloud computing comprise the entire spectrum of informationtechnology and includes, inter alia, infrastructure, platforms andsoftware.

“Program modules” should be taken to mean individual functional units,which enable an inventive program sequence of method steps. Thesefunctional units can be implemented in a single computer program or in aplurality of computer programs that communicate with each other. Theinterfaces actualized here can be implemented in terms of softwareinside a single processor or in terms of hardware if a plurality ofprocessors is used.

Unless disclosed otherwise in the description below, the terms “create”,“determine”, “calculate”, “generate”, “configure”, “modify” and the likepreferably refer to processes, which generate and/or change data and/orconvert data into other data. The data is present, in particular, asphysical variables, for example as electrical pulses or analogouselectrical variables. The requisite instructions are combined in acomputer program as software. Furthermore, the terms “transmit”,“receive”, “read in”, “read out”, “transfer” and the like refer to theinteraction of individual hardware components and/or software componentsvia interfaces.

According to one embodiment of the invention, it is provided that astart value is defined for the count data before first-timeimplementation of a checking operation.

The start value has to be an element of the series of numbers used. Inparticular, when using the natural numbers as count data, the startvalue is a natural number. It is advantageous to use a number not equalto one and, in particular when using a plurality of memory units, to usedifferent start values because this additionally reduces the probabilityor random matches of incorrect count data of different memory units. Theprocessing safety is advantageously further increased hereby since theprobability of unidentified storage errors or processing errorsoccurring is further reduced.

According to one embodiment of the invention, it is provided that thechecking operations respectively include at least the checking of allapplication data sets available at the beginning of the checkingoperation for the ongoing method.

In this embodiment of the method, it is determined at the start of thechecking operation which data sets are to be checked. The ascertainednumber of data sets for checking is subsequently checked. Once all datasets for checking have been checked the checking operation is completed.The count data can then be occupied by the subsequent count element. Bydefining, as it were, the scope of checking of a checking operation andsubsequent implementation thereof, the method of checking mayadvantageously be reliably carried out with little computing outlay.

Alternatively, it would also be possible, to purposefully check in achecking operation only those data sets, which were changed during thepreceding checking operation. This would include monitoring the datasets for use or changes, however, and this would make the sequence ofthe method more complicated. In addition, storage errors such as bitflips can also occur while the stored data is not being accessed. Themodification of data sets will be discussed in more detail below.

In principle, it is possible to implement a checking operation whenprecisely all data sets for checking are not required (retrieved and/orchanged) by application programs. It is also possible, however, toimplement the checking operation in parallel with application programsthat are running, therefore while the application programs are accessingthe entirety of the data sets being checked. In this case, data sets,which are currently being processed, cannot be checked (more on thisbelow).

According to one embodiment of the invention, it is provided that assoon as a checking operation has been completed, the count data isoccupied by a count element, which follows the count element for theprevious occupation of the count data.

A checking operation has been completed when all application data sets,which the checking operation includes, have been checked. This meansthat monitoring takes place during the checking operation as to whichapplication data sets have already been checked and which have not. Thismay be accomplished, for example, by means of the addresses of theapplication data sets with which the application data sets can beidentified.

Once a checking operation has ended, and the count data, which has beenmade available to the application program for checking, has beenoccupied by the subsequent count element, the application program canthen retrieve the updated count data in the subsequent checkingoperation. When checking the stored data sets it is then possible tocheck whether the data sets include the count data of the precedingchecking operation respectively because the application program “knows”by way of the previous increase in the count data, as it were, the countelement of the current checking operation. Since the count data is setto the current count element in the case of each checked data set (atleast if no error was determined), the checking operations according tothis method can be repeated as often as desired.

Alternatively, the object cited is inventively also achieved by theclaimed subject matter disclosed in the introduction (method forcomputer-assisted execution of an application program) in that, forcomputer-assisted execution of an application program, wherein a memoryunit is operated as explained above and wherein application data setsrequired for the execution are retrieved from the memory unit anddecoded,

-   -   after decoding of the application data sets the application        program is executed,    -   at least application data sets, which include data segments        changed or generated by the execution of the application        program, are encoded and saved in the memory unit.

The application program can preferably be executed step by step. Thismeans that the application data sets necessary for the execution of theapplication program also have to be retrieved from the memory unit andencoded respectively at least only for the pending step of theapplication program. Of course, on execution of the application programthe entirety of the application data sets necessary for execution of theapplication program is retrieved and decoded little by little and stepby step.

Because the memory unit is operated as described above according to themethod for computer-assisted operation of the memory unit, in otherwords application data sets, which include data segments changed orgenerated by the execution of the application program, are also occupiedduring encoding by the count data, which characterizes the currentchecking operation being implemented.

This has various advantages. If new data sets are created or data setsare changed (in other words, data in an existing data set, in particularthe data segments having application data are changed), these are savedwith count data, which is suitable for co-checking the correspondingdata sets at least in the next checking operation. If the saved datasets are error-free, these are namely also furnished with the suitablecount data in the next checking operation so they can be identified asbeing error-free.

This embodiment of the invention also has the advantage that data sets,which are not currently available for checking in the case of a checkingoperation running in parallel with data processing by applicationprograms, can be skipped by the checking operation since they areoccupied by current count data during execution by an applicationprogram, in particular by a utility program, which data enables checkingin the subsequent checking operation even if checking (for example by achecking program) in the current checking operation is skipped owing toparallel processing by the application program (utility program orservice program). This simplifies, in particular, the sequence of thechecking operation considerably since the checking operation, whenexecuting the check routine, can simply skip data sets being processedand a check does not have to be caught up on at a later instant of thecurrent checking operation. This can be advocated from a safetyperspective since the integrity of the data, while taking into accountthe count data, can also be implemented (or anytime soon in the nextchecking operation) by the application program and thus the relevantdata set is kept up to date.

According to one embodiment of the invention, it is provided that whenchecking the data after decoding of the application data sets and beforeexecution of the application program respectively

-   -   an error is determined for an application data set when the        count data characterizes neither the checking operation being        implemented nor the most recent completely implemented checking        operation,    -   the application program is executed if no error has been        determined.

In this embodiment of the invention, the advantages, which are achievedby regular checking of the data in the memory unit by means of checkingoperations, are additionally achieved in the processing of the data byan application program respectively. In other words, every time data isretrieved from the memory unit for processing, it is checked whether astorage error has occurred in the meantime. Additional safety isachieved hereby since even storage errors which randomly occurred indata sets between the last successful checking operation and theretrieval of the data set by an application program (in particularutility program) can be identified.

According to one embodiment of the invention, it is provided thatadditionally, during the computer-assisted operation of the memory unit,for first-time encoding of the data,

-   -   at least one group of application data sets, containing data        segments having identical application data for an application        program and check data segments having different diversity        characteristic data respectively is generated or selected from a        supply of possible diversity characteristic data,    -   each application data set is encoded and saved,    -   and the data is retrieved in that the application data sets are        retrieved and decoded, and the data is saved in that the        application data sets are encoded and saved,        and/or

during the computer-assisted execution, the application program isexecuted multiple times in redundant computing instances, wherein inorder to execute required application data sets, each application dataset of an encoded group of application data sets is retrieved from thememory unit and decoded, wherein

-   -   in order to check the data after the decoding of the application        data sets, an error is determined respectively for an        application data set if the diversity characteristic data in the        application data set deviates from all possible diversity        characteristic data of said computing instance from the supply,        i.e. from the supply provided for this computing instance,    -   the application program with the data segments of each        application data set of the relevant group is executed if no        error was determined,        and/or    -   at least application data sets, which due to the execution of        the application program include changed or generated data        segments, are encoded according to the manner mentioned above        and saved in the memory unit.

As will be described below, this embodiment of the invention is anadditional safety mechanism, which additionally further increasesoperation of the memory unit and execution of application programswithin the meaning of the statement of the object of the invention. Asalready explained, safety-relevant applications, in particular, forexample railroad applications, advantageously benefit from thisincrease. Only one of the errors described in the framework of thisinvention has to occur in order to bring about, overall, output of anerror. The level of safety in the implementation of the applicationprograms (utility programs) is thus increased independently of theinventive measures through which the error is identified. As alreadymentioned, the term “safety” is to be understood within the meaning ofoperational safety.

The formation of groups of application data sets, which contain datasegments having identical application data respectively, has theadvantage that computing operations, i.e., the execution of applicationprograms, which use the respectively identical application data, can becarried out redundantly. Should an error be identified in one of theapplication data sets, the relevant application data set can be excludedfrom processing without the process sequence having to be interruptedimmediately as a result because further application data sets are indeedavailable for carrying out the method, in other words, execution of therelevant application program.

The diversity characteristic data makes it possible to differentiate theapplication data sets with respectively identical application data fromeach other and enables an accurate assignment, for example to acomputing instance provided for the relevant application data. It ishereby also possible to check whether an error (referred to as anassignment error) has crept in when application data sets are assignedto particular computing instances. Such an identified error can alsotrigger suitable reactions in the process sequence. For example, theincorrect assignment of application data sets can result in the relevantcomputing instances being excluded from implementation of the method. Inthis case too, the remaining computing instances can continue to operatethe method, for which reason the method is not immediately interrupted.

If a plurality of application data sets is required for one applicationprogram (and this is the rule), then, in particular, each group ofapplication data sets can receive the same diversity characteristic dataagain. These are selected from a supply of diversity characteristicdata. In this way the assignment of application data sets to aparticular computing instance having a particular diversity (in otherwords, a computing instance to which diversity characteristic data of aparticular type is assigned from the supply) is by the diversitycharacteristic data. This already significantly increases theoperational safety and owing to the limited supply of diversitycharacteristic data, may be implemented with little computing outlay.

Where reference is made in connection with this application to data ingeneral, the data can have any desired content. In contrast, applicationdata, diversity characteristic data, redundancy data, count data, etc.is taken to mean particular data, in other words, data for a specificpurpose. A distinction is made, moreover, between

-   -   variable data: this data is occupied or changed depending on        runtime (in particular application data)    -   static data: program data (in particular, application data        describing application programs).

The data segment, containing application data (called application datasegment for short), can be executed (static data as instructions for therunning of the application program) or processed (variable data, to beprocessed, for the application program). A check data segment, whichpreferably contains the diversity characteristic data and/or redundancydata and/or count data, is used preferably for execution by way ofservice programs, which run in order to check the integrity of the data(more on this below).

Encoded saving of the application data sets advantageously increases theprobability of identifying data errors during processing (processingerrors) or during storage. Even a single bit flip, for example duringstorage of the data, would lead to a different result during decoding,so the encoded application data set differs significantly from theapplication data set for encoding. If an error of this kind isdiscovered, the measures that have already been mentioned are carriedout, so the method guarantees the requisite operational safety.

Use of the diversity characteristic data for identifying errors in theprocessing of the application data sets by way of an application programhas already been explained in detail above. For the purpose ofprocessing the application data sets, the data sets are decoded and,before they are saved in the memory unit stored again, are encodedagain. In addition, it is possible that application data sets arechanged by the execution of the application program or application datasets are formed with newly generated data segments. These are thenencoded according to the above-mentioned storage method and saved in thememory unit.

During checking of the diversity characteristic data it is at leastchecked whether the identified diversity characteristic data of anapplication data set differs from all possible (in other words, possiblefor the relevant computing instance) diversity characteristic data ofthe supply. An error is then determined. If the diversity characteristicdata corresponds to the anticipated diversity characteristic data, it isthus assumed that no error is present. Preferably, also only one type ofdiversity characteristic of the supply is permitted for one computinginstance. However, it is also possible to reserve the computinginstances in different regions for the purpose of better utilization ofthe computing instances for other diversity characteristic datarespectively (more on this below).

When checking the data it is possible to check, for example, whether thediversity characteristic data in the application data set deviates fromall possible diversity characteristic data from the supply, if it is inprinciple possible that all diversity characteristic data from thesupply can be used for one particular computing instance. It is alsopossible, however, that particular diversity characteristic data fromthe supply is reserved for a particular computing instance. In thiscase, it is only checked whether the diversity characteristic datadeviates from this reserved diversity characteristic data of thecomputing instance. The probability of discovering an error bydetermining incorrect diversity characteristic data advantageouslyincreases in the process.

According to one embodiment of the invention, it is provided that thedifferent diversity characteristic data of the supply includes differentencoding constants and decoding constants.

The encoding constants are used in an encoding algorithm and thedecoding constants in a decoding algorithm. Encoding algorithms anddecoding algorithms of this kind are known per se. Encoding and decodingmay advantageously be implemented with a high level of performance bymeans of the constants. This is merely a matter of attaining theoperational safety, and not of obtaining adequate security againstadversarial attacks which would only be possible with significantlygreater computing outlay and, associated therewith, loss of computingperformance.

If the encoding constants and decoding constants are simultaneously usedas diversity characteristic data, then this has the advantage that thediversity of the application data sets is contained in the encoding.That is to say, for encoding and decoding a pair of constants is used,which simultaneously define the diversity of the relevant applicationdata set. The constants thereby immediately fulfil two functionalitiessimultaneously, and this saves computing outlay and therefore increasesthe performance of the method.

According to one embodiment of the invention, it is provided that thediversity characteristic data includes an adjustment operator foradjusting the data segment generated by the decoding to the data segmentbefore the decoding.

The adjustment operator is necessary if the information content (forexample bit width) of the encoded and subsequently decoded applicationdata set is greater than that of the encoded application data set. Afterdecoding of the application data set, the superfluous information maynot then be taken into account by the application to be carried out andhas to be cut, as it were, by the adjustment operator. In general, thefollowing functional equation thereby results for an encoding anddecoding algorithm((AD opA C_enc)opB C_dec)opC Y==AD

-   -   where    -   AD application data set    -   opA encoding operator    -   C_enc encoding constant    -   opB decoding operator    -   C_des decoding constant    -   opC adjustment operator    -   Y desired information content

According to one embodiment of the invention, the encoding operator isan instruction with which a multiplication is carried out.

According to a further embodiment of the invention, it is provided thatthe decoding operator (and in particular also the encoding operator) isan instruction with which a multiplication is carried out as a decodingoperation (and, in particular, also as an encoding operation) and theadjustment operator is suitable, after the decoding, for limiting thedata segment to its original length.

If a multiplication is selected as a decoding operator (and, inparticular, also as an encoding operator), then this is an operation,which can advantageously be implemented in a computer with a high levelof performance. In particular, if the decoding constant (and, inparticular, also the encoding constant) are greater than 1 and areintegers, the operation may be implemented particularly easily in termsof computing effort. However, due to the two-time multiplication, thelength of encoded and subsequently of the decoded data segment becomesgreater. After decoding, the actual information content of the datasegment therefore has to be cut, as it were, from the overall result ofdecoding.

A modulo operation mod (also referred to as a length restrictionoperation) is preferably suitable for this purpose which, advantageouslyin the case of binary terms, cut the excess bits up to a desired bitwidth Y without changing the content of the bits of the remaining part.Additional memory space must be provided in the application data set forthis data in order to store the excess information (redundantinformation) in the encoded state (because decoding is successful onlywith the aid of this redundant information). To increase the safety ofthe method still further, the data in the additional memory space, asredundancy data, can also be checked for errors (more on this below).

The following expression results for the above functional equation forthe encoding and decoding by taking into account the multiplication asan encoding and decoding operation and the modulo operation as anadjustment operator:(AD C_enc C_dec)mod Y==AD

-   -   where    -   AD application data set    -   C_enc encoding constant>1    -   C_dec decoding constant>1    -   mod Y modulo operation    -   Y desired bit width

The encoding constant and the decoding constant are a pair of numbers,which, in particular, also characterizes the diversity of the relevantapplication data set. This pair of numbers is selected such when theapplication data set is multiplied by the encoding constant and theencoded application data set is subsequently multiplied by the decodingconstant, the bits of the desired bit width Y of the application dataagain have the same values per bit. One encoding constant and onedecoding constant each are available for each diversity in the supplyfor diversity characteristic data, which constants form one pair ofnumbers respectively with said properties. Experiments have shown thatan encoding and decoding algorithm, which uses the most recentlymentioned functional equation, can be carried out with a comparativelyhigh level of performance with regard to computing speed.

According to one embodiment of the invention, it is provided that beforeencoding, the check data segment is created in such a way that itadditionally has redundant memory space having predefined redundancydata.

As will be described below, this embodiment of the invention is anadditional safety mechanism, which additionally further increasesoperation of the memory unit and the execution of application programswithin the meaning of the object of the invention. As already explained,safety-relevant applications, in particular, advantageously benefit fromthis increase.

The gain in safety lies in that the predefined redundancy data in themethod is also known, because it is predefined. Redundant in the case ofthe redundancy data means that it is not necessary for storage of theapplication data. The redundancy data is required for encoding, however,because the data volume increases in the process. The redundancy data isoccupied by new data, which normally deviates from the predefinedredundancy data. This new data is necessary for a subsequent decoding.

If a corresponding encoding or decoding algorithm, then the redundancydata is filled with the originally predefined data again after decoding,however. This means that an error is determined when this condition isnot met.

Preferably, the predefined data can contain only zeroes or only ones.Filling with predefined data may be carried out particularly easily withlittle computing outlay in this way.

According to one embodiment of the invention, it is provided that theapplication data segments consist of data words.

A data word is a particular data volume, which a computer can process inthe arithmetic-logic unit of the processor in one step. If a maximumdata volume is meant, then its size, word width, processing width, orbus width will be stated. A data word can preferably have a word widthof 32, 64 or 128 bits. If the application data segments consist of datawords, this advantageously accelerates the execution of the individualmethod steps, whereby the inventive method can be carried out with anoptimum level of performance.

According to one embodiment of the invention, it is provided that themethod is carried out while simultaneously using at least two processorsor processing cores.

As already mentioned, the processors can be embodied physically (alsowith processing cores) or virtually (for example, emulated). A pluralityof processors or processing cores can advantageously be used, inparticular, to carry out computing processes redundantly, in otherwords, in parallel and in particular also simultaneously, to attainadditional safety with regard to the occurrence of errors whenprocessing the application data sets. The occurrence of errors can bechecked, for example, as will be explained in more detail below, byvoting.

According to one embodiment of the invention, it is provided that the atleast two processors or processing cores have shared access to one andthe same memory unit.

Access to one and the same memory unit means that the at least twoprocessors/processing cores use a shared memory unit, with the memoryunit not stipulating a physical separation of memory areas for the oneprocessor or the other processor. In other words, each processor can inprinciple access the entire memory area made available by the memoryunit. This does not, of course, rule out particular memory areas beingreserved, for example by the definition of memory addresses, for the oneor the other processor. This reservation can be changed or cancelledwithout interventions in terms of hardware, however, so potentially theentire memory area is available to each of the processors.

Use of shared memory units for a plurality of processors advantageouslyfacilitates use of COTS components. In addition, the acquisition of ashared memory unit is less expensive than when a separate memory unit isprovided for each processor. Inexpensive solutions in particular may beimplemented hereby.

According to one embodiment of the invention, it is provided that

-   -   with multiply stored identical data segments and/or with        multiply identically changed data segments, voting is carried        out,    -   if, owing to the voting, an error is identified, application        data sets, which contain data segments causative of the error        identification, are excluded from further processing.

Multiply stored identical data segments and/or multiply identicallychanged data segments occur when application data sets are redundantlystored and/or processed. The redundant data (in other words, therelevant application data segments) have to be identical, for whichreason differences that occur can be identified by voting and be outputas an error.

Carrying out voting in order to identify data errors is known per se.For example, it is possible to calculate independent application datasets in a plurality of, preferably three, parallel process sequences andto subsequently compare them in the framework of voting. The results arethen only deemed to be trustworthy if at least the majority of thecompared results matches. The parallel execution of an application bythe computing environment can be carried out in the computingenvironment, in particular, by three application data sets processed inparallel. This can advantageously ensure that processing of a data setcan be carried out without feedback respectively in respect of the otherprocessing operations. Advantageously, the probability of errorsoccurring in the processing of an application data set having an effecton the processing of other data sets can thus be reduced as far aspossible.

On determination of a data error in a checking operation or duringexecution of the application program or of a processing error duringvoting, further processing of the data can be prevented or at leastsuspended, or prevented or at least suspended only for applications,which attain or exceed a predefined safety level. This has the advantagethat the computing capacity of the affected host computers continues tobe available for non-safety-relevant applications. This means theapplications can be carried out if errors that occur (for example aprogram crash) do not hold any safety-relevant risks (safety-relevantrisks in the case of railroad applications are, for example, traincollisions or other accidents).

In an advantageous variation, the first and the second of theapplication programs are stopped if the data segments to be compared donot match or the count data in the checking data segments pertaining tothese data segments characterize neither the checking operation beingimplemented nor the most recent completely implemented checkingoperation.

Stopping the program sequence advantageously effectively preventserroneous processing of the application from being continued. Followingthis the relevant application program (incl. subprograms, programcomplexes) can also be started again if the error has been rectified.Operation, for example of a railroad application, can continue whileindividual application programs or host computers are restarted, inparticular if the application programs are executed redundantly to beable to carry out subsequent voting of the generated variable data.

According to one embodiment of the invention, it is provided that

-   -   application data sets, which contain data segments causative of        errors, are updated using the error-free data segments of the        corresponding application data sets,    -   the updated application data sets are again incorporated in        further processing.

The corresponding application data sets, which contain relevanterror-free data segments, are thus used for updating. This means that inthe application data sets, the data segments having identicalapplication data are selected, in other words, application data sets,which belong to the same group of application data sets. As alreadyexplained, these differ namely only by way of the check data segments,but not by way of the data segments representing the application data,in other words, application data segments, so they can be used, as itwere, to repair the identified error—provided the error-free datasegments could be identified by the voting.

Updating faulty data segments makes permanent operation of the computingenvironment possible. Otherwise, increasingly more application data setswould be blocked by determination of errors, so the method would nolonger be permanently executable. Even voting could no longer be carriedout at some point in the absence of redundancy when generating data.

Apart from voting, the redundancy of the data, however, also enables theoperation of the computing environment, in other words, processing ofapplication data sets, while errors in individual application data setsare determined and corrected. The latter are namely only excluded fromprocessing until they have been repaired in accordance with the abovemethod. During the exclusion of corrupt application data sets furtherredundant application data sets with data integrity exist, however, withwhich the method, without delays occurring in the application, cancontinue to be carried out. The repaired application data sets can thenbe activated later, for example in a break in operation.

Furthermore, a computer program product having program commands forcarrying out said inventive method and/or its exemplary embodiments isclaimed, wherein the inventive method and/or its exemplary embodimentsrespectively can be carried out by means of the computer programproduct.

Furthermore, a provision apparatus for storing and/or providing thecomputer program product is being claimed. The provision apparatus is,for example, a memory unit, which stores and/or provides the computerprogram product. Alternatively and/or in addition, the provisionapparatus is, for example, a network service, a computer system, aserver system, in particular a distributed, for example cloud-based,computer system and/or virtual computer system, which stores and/orprovides the computer program product preferably in the form of a datastream.

The provision takes place in the form of a program data block as a file,in particular as a download file, or as a data stream, in particular asa download data stream of the computer program product. This provisioncan also take place, for example, as a partial download, however, whichconsists of a plurality of parts. Such a computer program product isread into a system, for example using the provision apparatus, so thatthe inventive method is implemented on a computer.

Once more in a simplistic summary: The subject matter of the inventionis a method for computer-assisted operation of a memory unit, whereindata is saved in the memory unit and the data is encoded before saving,data is retrieved from the memory unit and the data is decoded afterretrieval. The memory unit is monitored for errors in that a temporalsequence of computer-assisted checking operations is carried out for thememory unit. For first-time encoding of the data, each requiredapplication data set is generated or selected, containing check datasegments. For each application data set, the check data segment isoccupied by count data, which characterizes the checking operation beingimplemented. Each application data set is encoded and saved. Forchecking the data in the checking operation being implemented, afterretrieving and decoding the application data sets respectively, an erroris determined for an application data set when the count datacharacterizes neither the checking operation being implemented nor themost recent completely implemented checking operation. The check datasegment of the relevant application data set is occupied by count data,which characterizes the checking operation being implemented, if noerror was determined. The relevant application data set is encoded andsaved again if no error was determined.

Other features which are considered as characteristic for the inventionare set forth in the appended claims.

Further details of the invention will be described below with referenceto the drawings. Identical or corresponding drawing elements areprovided with identical reference characters respectively and will onlybe explained multiple times to the extent that differences emergebetween the individual figures.

The exemplary embodiments explained below are preferred embodiments ofthe invention. In the exemplary embodiments, the described components ofthe embodiments represent individual features of the invention that areto be considered independently of each other respectively, whichrespectively develop the invention, also independently of each other,and should therewith also be regarded individually or in a combinationdifferent to that shown as an integral part of the invention.Furthermore, the described components can also be combined by with thefeatures of the invention described above.

Although the invention is illustrated and described herein as embodiedin a method for computer-assisted operation of a memory unit andexecution of application programs having memory checking for memoryerrors, it is nevertheless not intended to be limited to the detailsshown, since various modifications and structural changes may be madetherein without departing from the spirit of the invention and withinthe scope and range of equivalents of the claims.

The construction and method of operation of the invention, however,together with additional objects and advantages thereof will be bestunderstood from the following description of specific embodiments whenread in connection with the accompanying drawings.

BRIEF DESCRIPTION OF THE FIGURES

FIG. 1 is a schematic view of a railroad application having a computingenvironment with its cause-effect relationships, it being possible foran exemplary embodiment of the inventive method to be embodied with thecomputing environment;

FIG. 2 , which consists of the partial FIGS. 2A and 2B, shows a blockdiagram of an exemplary embodiment of the inventive method on the basisof a computing environment in the railroad application of FIG. 1 ,having two host computers, with the individual functional unitscontaining program modules, which produce application programs and canrun in one or more processors respectively and the interfaces canaccordingly be embodied in terms of software or hardware;

FIG. 3 is a schematic illustration of an exemplary method step for thefirst-time encoding of data according to the invention;

FIG. 4 is a schematic view showing the use of the application data setof FIG. 3 and further application data sets having second diversitycharacteristic data and third diversity characteristic data; and

FIG. 5 is a process flowchart illustrating a possible sequence for thecomputer-assisted operation of a memory unit and for computer-assistedexecution of an application program, wherein it is possible for theindividual method steps to be implemented individually or in groups byprogram modules and with the functional units and interfaces shown inFIG. 2 .

DETAILED DESCRIPTION OF THE INVENTION

FIG. 1 schematically represents a railroad application, which iscontrolled by a computing environment RU. The railroad application hasrails GL on which various components of the interlocking engineering arerepresented by way of example. These are a switch drive WA, which canset a switch WH. Furthermore, a balise BL is installed in one of therails, with the aid of which information can be exchanged with thetrains traveling over the balise. Finally a light signal LS isrepresented, which is controlled by a controller CL.

The computing environment RU can have various host computers HR1, HR2,HR3 among which applications in the form of application programs forcontrolling the railroad application are distributed (more on thisbelow). The first host computer HR1 is made available by a computingcenter RZ and is connected to a first memory unit SE1 by a firstinterface S1. The computing center RZ can be operated, for example, by aservice provider of the rail operator or by the rail operatorthemselves. The first host computer HR1 is connected to a Cloud CLD by asecond interface S2. Accordingly, this computer is not locally connectedto the railroad application.

A control center LZ of the rail operator accommodates the second hostcomputer HR2, which is likewise connected to the Cloud CLD by a thirdinterface S3. In addition, the second host computer HR2 is connected toa second memory unit SE2 by a fourth interface S4.

The computing environment RU also has, by way of example, aninterlocking STW (interlocking station, signal box, switch tower), whichaccommodates the third host computer HR3, which is connected to a thirdmemory unit SE3 by a sixth interface S6. In addition, the third hostcomputer HR3 has a fifth interface S5 to the second host computer HR2.The host computer HR3 can also be connected to the Cloud CLD. The thirdhost computer HR3 also has a seventh interface S7 to the switch driveWA, an eighth interface S8 to the controller CL and a ninth interface S9to the balise BL.

All interfaces S1 . . . S9 in FIG. 1 in principle can be implementedwith cables or also by wireless transmission technology, for exampleradio. The arrangement of the host computers HR1 . . . HR3 is merely byway of example and can be expanded as desired with more complex railroadsystems. A computing environment is defined in that the participatinghost computers HR1. . . HR3 can communicate among themselves and theapplications can thereby be executed by taking into account availablecomputing capacities distributed among the host computers HR1 . . . HR3.Computing instances are formed for this purpose, and these will bedescribed in more detail below (cf. FIG. 2 where the computing instancesRP1 . . . RPn are represented).

FIG. 2 represents the configuration of the first host computer HR1 andthe second host computer HR2 of FIG. 1 by way of example. Further hostcomputers can be incorporated analogously. The host computers areorganized such that for the purpose of accomplishment, particular taskcomplexes in the form of program complexes PK1, PK2, PK3, PK4 areorganized on the host computers, and these consist of individualapplication programs AP1 . . . AP5.

Program complexes generally combine a number of application programswhose joint execution can be combined with a view to all of theapplications. In particular, it can be provided that all applicationprograms contained in one data set are combined to form one programcomplex. This takes account of the fact that with regard to the databeing applied, the data set brings about combining of data segmentswhile parallel herewith a program complex combines the correspondingapplication programs to which the data segments are assigned.

Configuration data KD1 . . . KD13 should be taken to mean data, whichconfigures application programs for the individual demands of theindividual application at hand. The configuration defines theinteraction of different application programs among themselves and thefunction of the application programs on the hardware components on whichthey are installed. In addition, the configuration contains adjustmentsto the individual application at hand for which the relevant applicationprogram is intended (for example parameters, which can be differentiatedin different individual applications).

On the basis of the fifth application program AP5 it is also shown thatthis can be implemented by individual subprograms. The subprograms ofthe fifth application program AP5 are a gateway GW, a voter VT, a clockTG and a message broker MB (more on this below). This should beunderstood merely as an example, however. Alternatively, the clock couldrun, for example, in a different application while the remainingsubprograms run, as described, in the application program AP5.

Within the meaning of the invention, subprograms can, in general, betaken to mean smaller units such as program modules, the entirety ofwhich produce the application program. It is thus advantageouslypossible to form application programs modularly, in other words, toprovide, for example, program modules, which are used in a plurality ofapplication programs. The subprograms can be configured with differentconfiguration data, depending on their use. Subprograms thus make itpossible to be able to create application programs more easily andtherewith be able to adjust the computing environment more easily to anindividual application.

In connection with the creation of program complexes, applicationprograms and subprograms it should be noted that configuration datarespectively can be assigned to the program complexes, the applicationprograms and the subprograms respectively. Multiple storing ofparticular data with the same content can occur in this case, with thisrespectively producing data segments, which can, in turn, be uniquelyassigned to a program complex, application programs or subprograms. Thepossibility of unique assignment in order to have available uniquelyaddressable data segments for implementing test functions is importanthere.

The fifth application program AP5 is identically organized in allprogram complexes PK1 . . . PK4. Messages can be exchanged with theCloud CLD via the gateway GW. The gateway GW thus embodies theinterfaces S2 and S3 of FIG. 1 . The messages are distributed within theprogram complexes PK1 . . . PK4 via the message broker MB, preferablyaccording to the Publish-Subscribe method. The gateway GW uses, forexample, an interface S14 to make received messages to redundantcomputing instances RP1 . . . RPn available via the message broker MB.These messages are then retrieved by the redundant computing instancesRP1 . . . RPn. This is indicated by nodes KN, which are indicated in theinterface S14 (and likewise in the further interfaces S10 . . . S13described below).

In FIG. 2 the program complexes PK1 . . . PK4 are completely implementedin one host computer HR1 . . . HR2 respectively for the sake of clarity.In reality, program complexes with their application programs AP1 . . .AP5 and the subprograms thereof can also run distributed among aplurality of host computers. This advantageously makes it possible touse capacities of host computers when they do not make sufficientcapacity available for the configuration of an entire program complex inthat the capacity of a plurality of host computers is jointly used forthe relevant program complexes.

The program complexes can be provided, for example, for a particulartask complex. For example, a program complex can be used for actuationof a particular railroad component (signal, interlocking, switch, axlecounter, etc.). Generally a plurality of application programs isnecessary for actuation of these railroad components. In particular,application program AP5 (already explained above) is also required toguarantee safe execution of the application and communication with otherhost computers. This should be referred to as a service program, whichserves to safeguard the function of the host computer and therewithexecutes an application relevant to the host computer (in contrast tothe useful data for application programs AP1 . . . AP4 processingrailroad components, which are thus referred to as utility programs).The application program AP5 likewise runs in at least one computinginstance RP9 . . . RP12 per host computer, although preferably notredundantly.

Within the meaning of the invention, a large number of redundantcomputing instances is taken to mean a software implementation on thehost computers HR1 . . . HR3, which allow parallel, in other words,simultaneous execution of application programs AP1 . . . AP4, preferablywithin the respective program complex PK1 . . . PK4. FIG. 2 representsprogram complexes each having two redundant computing instances,although three redundant computing instances are preferably used,although more redundant computing instances RP1 . . . RPn, asrepresented, by way of example, for the first program complex, are alsoconceivable. The method for executing the application programs using thefirst program complex PK1 will be explained below for the firstredundant computing instance RP1, the second redundant computinginstance RP2 . . . and the nth redundant computing instance forexecuting the first application program AP1. Execution runs accordinglyfor the program complexes PK2 . . . PK4, however, so these do not haveto be explained separately.

The first application program AP1 is executed redundantly, thereforesimultaneously in parallel, in the first redundant computing instanceRP1, . . . and the nth redundant computing instance RPn. This is anapplication program, which undertakes a task for the railroadapplication of FIG. 1 . First configuration data KD1 is available fromthe first redundant computing instance RP1 through to the nth redundantcomputing instance RP2, moreover, which data is necessary for executionof the first application program AP1 in order to execute the individualtask of the railroad application. For example, the first applicationprogram AP1 can in general serve to actuate light signals, with thefirst configuration data KD1 guaranteeing the application of the firstapplication program AP1 to the light signal LS of FIG. 1 . For example,communication with the controller CL of FIG. 1 has to be ensured forthis.

Configuration data KD1 . . . KD13 is also available for all otherprogram complexes PK1 . . . PK4, application programs AP1 . . . AP4 andsubprograms MB, TG, VT, GW. Accordingly, the configuration data KD1 . .. KD13 contains the data necessary for the program complexes,application programs and subprograms respectively, so they can undertakethe tasks assigned to them in the relevant individual application. Theconfiguration data is constant respectively and can therefore be storedin a data segment with known start and known end. Similarly, all programcomplexes PK1 . . . PK4, application programs AP1 . . . AP4 andsubprograms TG, VT, GW, MB are stored as data segments having knownstart and known end. For example, the first memory unit SE1, the secondmemory unit SE2 and the third memory unit SE3 of FIG. 1 are availablefor this. Data, which is stored in one of said memory units or remainsstored in one of said memory units over a certain period, is subject toregular checking operations by way of which storage errors in the storeddata can be identified (more on this below). Memory errors are taken tomean errors, which occur or arise in the data when saving or whenretrieving the data while the data is being stored in the memory unit.

Data which changes during the execution of programs is exchanged betweenthe participating partners as messages. As already mentioned, themessage broker MB is available for this. In addition, the individualhost computers HR1, HR2 communicate among themselves via the externalinterfaces S2, S3, for example by means of a Cloud CLD, so data can alsobe exchanged between different program complexes PK1 . . . PK4 ofdifferent host computers. After modification of the data, the data issaved in the first memory unit SE1, the second memory unit SE2 or thethird memory unit SE3 again. Errors in the data can also occur duringprocessing, which errors will be referred to more precisely asprocessing errors within the framework of this invention.

The sequences in the railroad application of FIG. 1 are relevant to theoperational safety of the railroad application. This is why the firstapplication program AP1 is executed simultaneously in parallel, in otherwords, redundantly, in the redundant computing instance RP1 through tothe nth redundant computing instance RPn. The first redundant computinginstance RP1 and the second redundant computing instance RP2 send theresult during execution of the application to the message broker MB,and, more precisely, the first redundant computing instance RP1 via theeleventh interface S11 and the second redundant computing instance viathe interface S12. These results are retrieved via said interfaces bythe voter VT, which carries out voting. Only when the majority of theresults match (that is to say, in the case of two redundant computinginstances, both results, in the case of three redundant computinginstances, at least two results, in the case of four redundant computinginstances, at least three results, . . . in the case of n redundantcomputing instances, at least n/2+1 in the case of even n and n/2+0.5 inthe case of odd n), is the result made available to the message brokervia the thirteenth interface S13 and is it possible for it to beretrieved by the gateway GW via the thirteenth interface S13 fortransmission to other units via the second interface S2.

So the calculation results are simultaneously available for voting bythe voter VT, the processes are clocked in the first redundant computinginstance RP1 and in the second redundant computing instance RP2 by theclock TG. This makes clock signals available via the tenth interfaceS10, and these can likewise be retrieved by the first redundantcomputing instance RP1 and the second redundant computing instance RP2via the message broker MB.

The illustrated manner of executing tasks by the first applicationprogram AP1 and the second application program AP2 is ensured by thefifth application program AP5. The fifth application program AP5 istherefore an internal application program, which supports thefunctioning of the host computers HR1 . . . HR3. This makes it clearthat application programs have to be made available not only for theapplication of the railroad application of FIG. 1 (utility programs),but also for the execution of applications in the host computers HR1 . .. HR3 (service programs).

The combination of application programs to form program complexes andthe division of application programs into subprograms facilitates thecompiling of application programs and the checking of the execution oftasks for freedom from errors in this connection. For this purpose, datais combined to form data segments, which can be uniquely identified andaddressed as such respectively (by way of definition of a start of thedata segment and an end of the data segment). As already mentioned,subprograms, application programs, program complexes and therespectively associated configuration data (with these usuallycomprising a large number of data segments) are defined in datasegments. Here the necessary data is preferably stored several timesusing the diversity characteristic data, so the data segments andconfiguration files can be uniquely assigned respectively. In otherwords, the situation where different application programs, if they useidentical configuration data, access the same memory location for thisdata does not occur in this case. Instead they always access the datasegment assigned to them respectively in which the data is available.

FIG. 3 schematically represents the method step of first-time encodingof data according to the invention. This is represented for a computingenvironment consisting of, for example, the first host computer HR1, thefirst memory unit SE1 and the second memory units SE2. In principle, thefirst host computer HR1 can access data, which is stored in the firstmemory unit SE1 and in the second memory unit SE2. Reading RE andwriting WT can take place, and this is indicated by correspondingarrows.

For example applications AP for carrying out application programs can bestored in the memory units SE1, SE2. Furthermore, it is possible tostore count data ZD and a supply VR of diversity characteristic data DD1. . . DD4. To use the application data AD for applications within themeaning of the invention, in other words, to inventively carry out amethod for computer-assisted execution of an application program, theapplication data AD has to be stored in the form of application datasets ADS, which are created by means of the method of FIG. 3 and arestored in an encoded manner by way of encoding COD.

FIG. 3 represents merely by way of example how the application data AD,the count data ZD and the diversity characteristic data DD1 . . . DD4occupy individual memory areas of the first memory unit SE1 and thesecond memory unit SE2. In principle it is arbitrary where thecorresponding data is saved; it is located by a suitable addressing andthere are no restrictions as to which application data set ADS is storedwhere in the memory units SE1, SE2.

Furthermore, the diversity of the diversity characteristic data DD1. . .DD4 is indicated by hatched areas, and this is intended to make it clearthat application data sets ADS can be characterized by the diversitycharacteristic data from the supply VR. As shown by the supply VR, alengthwise hatching, a cross hatching and two instances of obliquehatching are available, which are at an angle of 90° to each other. Theapplication data set ADS represented in detail in FIG. 3 has, forexample, the hatching, which points to the diversity characteristic dataDD1.

As the application data set ADS, which is represented in enlarged form,shows, it consists of one data segment DA for the application data ADand one check data segment PA, which has the first diversitycharacteristic data DD1, a count element in the count data ZD andredundancy data RD. The first diversity characteristic data DD1, thecount data ZD, the redundancy data RD, which is occupied by a startvalue, and the application data AD are written in the host computer HR1,for example into a random-access memory, and are combined to form theapplication data set ADS. The application data set ADS is subsequentlyencoded and written into the first memory unit SE1, with the diversityon the basis of the first diversity characteristic data DD1 also beingindicated in the memory unit SE1 by said hatching. The application dataset ADS is available for further processing here.

FIG. 4 schematically represents the use of the application data set ofFIG. 3 and further application data sets having the second diversitycharacteristic data DD2 and the third diversity characteristic data DD3.The three represented application data sets ADS should contain identicalapplication data. The check data segment PA is in each case occupied bythe different diversity characteristic data DD1, DD2, DD3 respectively.The count data ZD and the redundancy data RD can also deviate from eachother.

The application data sets ADS are now executed in three computinginstances RP1, RP2, RPn (in the explained example n is equal to 3 butcould also have a different value). For this purpose, the applicationdata sets ADS are read into the computing instance respectively. Oneparticular diversity respectively is assigned to the computing instancesRP1, RP2, RPn, and this is represented by hatching accordingly. Thishatching corresponds to that of the diversity characteristic data DD1 .. . DD3 of the supply VR respectively.

It can also be seen that a computing instance RPn can also process datafrom two diversities, in the present case the application data sets ADScharacterized by the diversity characteristic data DD3 and the diversitycharacteristic data DD4. Optimum utilization of the computing capacitymade available by the computing instance RPN can be achieved hereby.

The computing instances RP1 . . . RPn read out the application data setsADS of the correct diversity respectively. This is achieved by serviceprograms, which run in the background, so the computing instances RP1 .. . RPn are automatically supplied with the correct application datasets ADS. This is represented in more detail for the application dataset ADS of FIG. 3 having the diversity characteristic data DD1 and shallbe explained in more detail.

Once this application data set ADS has been retrieved it is firstlydecoded in order to subsequently be read. By way of the decoding, thefirst diversity characteristic data DD1, the current count data ZD andthe redundancy data RD together with the application data AD can be readout and service programs applied, which identify storage errors thathave potentially occurred. It is possible to check whether the diversitycharacteristic data DD1 originates from the supply VR and/or matches thediversity of the first computing instance RP1. Using the count data ZDit is possible to check the proper course of checking operations sinceit has to characterize the checking operation currently taking place orthe checking operation that previously took place. Only if the testshows that the data does not have any storage errors is it released forreading RE and processed by the first computing instance RP1.

After processing of the application data set ADS, the first computinginstance RP1 writes the data set back into the first memory unit SE1.The check data segment, the first diversity characteristic data DD1, thecount data ZD and the redundancy data RD can also be checked here inorder to identify potential processing errors in the processing of theapplication data set ADS. In addition, the count data ZD is equated withthe count element, which characterizes the checking operation that iscurrently running. The application data set ADS is subsequently encodedand written into the first memory unit SE1.

Even if it is not represented in detail, this method is likewise carriedout for the further application data sets in the computing instancesRP2, RPn. After successful processing of the application data sets ADS,voting can additionally be carried out for the application data AD todetermine that the application data sets AD were identically changedalso after processing by the computing instances RP1 . . . RPn. If thisis not the case, then this points to a processing error. With threecomputing instances RP1 . . . RPn, a majority voting can be carried out,moreover, so the application data, which is identical for the most part,is used for further processing while the application data, which differsfrom it, is blocked for further processing.

One possible sequence for the method for computer-assisted operation ofa memory unit and for computer-assisted execution of an applicationprogram shall be explained with reference to FIG. 5 . Before the methodis started an initialization step INI is carried out, with thispermitting proper memory access to a memory unit. Once the method hasstarted, the method for carrying out checking operations of the memoryunit are represented here on the right-hand side and the execution ofapplication programs on the left-hand side. These subsections can becarried out individually one after the other or preferably in paralleland are therefore shown side by side.

Firstly the method for carrying out the checking operation shall beexplained. A start value is defined for the count data in a determiningstep for the count data DTM_ZD. This count data, in an output step forcount data ZD_OT, if needed, is made available to the method forexecution of an application program via an input step for count dataZD_IN.

The actual checking operation consists of repeating procedures, which iscarried out for all application data sets that are stored in the memoryunit (represented on the right-hand side in FIG. 5 ). The following iscarried out for each application data set with the current countelements of the count data:

The application data set is decoded in a decoding step for theapplication data set DEC_ADS. It is checked in a checking step for thecount data TST_ZD whether the count element matches the checkingoperation currently being checked or the last checking operation. It ischecked in a checking operation for the diversity characteristic dataTST_DD whether the application data set has diversity characteristicdata, which matches the available supply VT of diversity characteristicdata (cf. FIGS. 3 and 4 ). It is checked in a checking step for theredundancy data TST_RD whether the redundancy data has an anticipatedvalue, in particular an initial value.

Once all checking steps have been carried out, a query step checks fordeviations DVG? whether one of the checking steps, as described above,has caused deviations from the anticipated result. If this is the case,an error is output in an output step for errors ER_OT (more on thisbelow). If this is not the case, the checked application data set isencoded again in an encoding step for the application data set COD_ADS,with this data set always being encoded in the count data with the countelement of the current checking operation. Once the checking operationhas been carried out for all application data sets, they thus have thecurrent count element in the count data, and the count data can beupdated in an updating step for the count data UPD_ZD for the serviceprogram that is currently running to the extent that this data nowincludes the count element of the checking operation which willsubsequently begin.

In the method for computer-assisted execution of an application program(left-hand side in FIG. 5 ), after the input step for the count dataZD_IN, which has already been mentioned, the decoding step for therelevant application data set DEC_ADS is repeatedly carried out for allrequired application data sets of the application carried out by theapplication program. Subsequently, as already described for the checkingoperation, a checking step for the count data TST_ZD, a checking stepfor the diversity characteristic data TSD_DD and a checking step for theredundancy data TSD_RD is carried out.

The special feature is that the application is carried out on acomputing instance having a particular diversity, so the diversitycharacteristic data checked in the checking step for the diversitycharacteristic data TSD_DT must exactly match the diversity of thecomputing instance on which the application program is to be carriedout.

During execution of the application program too, for each requiredapplication data set it is checked in the checking step for deviationsDVG? whether the checking steps TST . . . have identified deviationsfrom the anticipated contents of the application data sets. If this isthe case, as already explained, an error is output in the output stepfor errors ERR_OT. Otherwise, checking of the application data sets iscontinued until all application data sets necessary for the applicationprogram have been checked. It is only under this precondition that theapplication program is executed in an execution step for the applicationprogram RUN_APP.

The application data sets can preferably be checked step-by-step for theapplication program (not represented in FIG. 5 ). That is to say, theexecution of the application program is divided into execution steps.Within this meaning, all application data sets necessary for theapplication program, which are necessary for the next step to be carriedout by the application program respectively, are to be checked. Therelevant step of the application program is then executed in theexecution step for the application program RUN_APP. A plurality ofrecursion loops, which, after the encoding step described below for theapplication data set COD_ADS (on the left-hand side of FIG. 5 ), againresults in the input step of the count data is then produced for eachapplication program in FIG. 5 .

After the execution step for the application program RUN_APP, it ischecked whether the application data sets that exist after the executionof the application program are new application data sets. This check(called query step of new application data set NW_ADS?) is necessary soin a determining step for a check data segment DTM_PA, new applicationdata sets are assigned checking data, which makes subsequent checking ofthe application data set ADS in the further steps of the presentedmethod possible. In each case, the new application data set or also theold application data sets are encoded again in the encoding step forapplication data sets COD_ADS and stored in the memory unit. A furtherapplication program or, as described above, a further step of an ongoingapplication program can be subsequently carried out (repetition ofZD_IN, input step for count data and the subsequent steps).

A plurality of application programs can also be executed simultaneouslyin redundant computing instances. In this case, the sequence forcarrying out application programs would be represented multiple timesnext to one another in parallel, which is not represented here.

The implementation step for the application program RUN_APP can alsoachieve results which should be output. Before this occurs, a testprocedure can optionally likewise be run through, represented in thecenter of FIG. 5 . The steps that have already been explained, thechecking step for the count data TSD_ZD, the checking step for thediversity characteristic data TSD_DD and the checking step for theredundancy data TSD_RD therefore, are carried out in this connection. Ina subsequent query step for deviations DVG? it is again checked whetherdeviations could be determined in the checking steps. If this is thecase, as already described, an error signal is generated in an outputstep for an error ERR_OT. Otherwise, the result is output and/orprocessed further in further steps in an output step for the resultOT_RS.

For the case where an error is output in an output step for an errorERR_OT, the method is stopped immediately in the exemplary embodiment ofFIG. 5 . The computing environment can subsequently be reset by theinitialization step INI and the method started again, for example.

The following is a summary list of reference numerals and thecorresponding structure used in the above description of the invention:

LZ control center

STW interlocking

RZ computing center

GL rail

WH switch

WA switch drive

LS light signal

CL controller for light signal

BL balise

RU computing environment

HR1 . . . HR3 host computer

SE1 . . . SE3 memory unit

S1 . . . S14 interface

CLD Cloud

RP1 . . . RP8 RPn redundant computing instance

AP1 . . . AP5 application program

PK1 . . . PK4 program complex

KD1 . . . KD13 configuration data

MB message broker

TG clock

VT voter

GW gateway

KN node

DD1 . . . DD4 diversity characteristic data

ZD count data

RD redundancy data

AD application data

DA data segment with application data

PA check data segment

ADS application data set

CDS encoded application data set

GR group

VR supply

COD encoding

DEC decoding

RE reading

WT writing

DTM_ZD determining step for count data

UPD_ZD updating step for count data

DEC_ADS decoding step for application data set

COD_ADS encoding step for application data set

TST_ZD checking step for count data

TST_DD checking step for diversity characteristic data

TST_RD checking step for redundancy data

DVG? query step for deviations

ERR_OT output step for errors

INI initialization step

RUN_APP execution step of application program

ZD_IN input step for count data

ZD_OT output step for count data

OT_RS output step for result

NW_ADS? query step of new application data set

DTM_PA determining step

The invention claimed is:
 1. A method for computer-assisted operation ofa memory unit, the method comprising: saving data in the memory unit andencoding the data prior to saving; retrieving the data from the memoryunit and decoding the data after retrieval; monitoring the memory unitfor errors by carrying out a temporal sequence of computer-assistedchecking operations for the memory unit; for a first-time encoding ofthe data: generating or selecting at least one application data setcontaining a data segment having application data for an applicationprogram and a check data segment; writing count data that characterize achecking operation being implemented to the check data segment of eachof the at least one application data set; and encoding and saving eachof the at least one application data set; for checking the data in thechecking operation being implemented, after retrieving and decoding theat least one application data set: determining an error for the at leastone application data set when the count data characterizes neither thechecking operation being implemented nor a most recent completelyimplemented checking operation; when no error was determined, occupyingwriting the count data that characterize the checking operation beingimplemented to the check data segment of the at least one applicationdata set; and encoding and saving the at least one application data setif no error was determined.
 2. The method according to claim 1, whichcomprises defining a start value for the count data before a first-timeimplementation of the checking operation.
 3. The method according toclaim 1, wherein the checking operation includes at least a checking ofall application data sets available at a beginning of the checkingoperation for an ongoing method.
 4. The method according to claim 1,which comprises, as soon as a checking operation has been completed,writing a count element to the count data that follows the count elementfor a previous occupation of the count data.
 5. A method forcomputer-assisted execution of an application program, the methodcomprising: operating the memory unit by the method according to claim 1and retrieving application data sets required for an execution from thememory unit and decoding the application data sets; after decoding theapplication data sets, executing the application program; and encodingand saving in the memory unit at least the application data sets, whichinclude data segments that were changed or generated by the execution ofthe application program.
 6. The method according to claim 5, whichcomprises, when checking the data after decoding of the application datasets and before execution of the application program, respectively:determining an error for an application data set when the count datacharacterizes neither the checking operation being implemented nor amost recent completely implemented checking operation; executing theapplication program if no error has been determined.
 7. The methodaccording to claim 5, which further comprises, during thecomputer-assisted operation of the memory unit, for the first-timeencoding of the data: generating, or selecting from a supply of possiblediversity characteristic data, at least one group of application datasets, containing data segments having identical application data for anapplication program and check data segments having different diversitycharacteristic data; encoding and saving each application data set;retrieving the data by retrieving and decoding the application datasets, and saving the data by encoding and saving the application datasets; and/or during the computer-assisted execution, executing theapplication program multiple times in redundant computing instances,wherein in order to execute required application data sets, eachapplication data set of an encoded group of application data sets isretrieved from the memory unit and decoded, wherein: in order to checkthe data after the decoding of the application data sets, an error isdetermined respectively for an application data set if the diversitycharacteristic data in the application data set deviates from allpossible diversity characteristic data of the computing instance fromthe supply; executing the application program with the data segments ofeach application data set of a relevant group if no error wasdetermined; and/or encoding and saving in the memory unit at least thoseapplication data sets that include data segments that were changed orgenerated by the execution of the application program.
 8. The methodaccording to claim 5, which comprises, before encoding, creating thecheck data segment such that the check data segment also has redundantmemory space with predefined redundancy data.
 9. The method according toclaim 5, wherein the data segments consist of data words.
 10. The methodaccording to claim 5, which comprises carrying out the method withsimultaneous use of at least two processors or processing cores.
 11. Themethod according to claim 10, wherein the at least two processors orprocessing cores have shared access to the memory unit.
 12. The methodaccording to claim 5, which comprises: with multiply stored identicaldata segments and/or with multiply identical changed data segments,carrying out a voting process; and when an error is identified by thevoting process, excluding from further processing those application datasets that contain data segments causative of the error identification.13. The method according to claim 12, which comprises: updating theapplication data sets, which contain data segments causative of errorswith error-free data segments of the corresponding application datasets; incorporating updated application data sets in further processing.14. A computer program product having program commands for carrying outthe method according to claim
 1. 15. An apparatus for providing acomputer program product, comprising a memory device for saving and/orproviding a computer program product with program commands innon-transitory form for carrying out the method according to claim 1.